Systems and methods for detecting cryptocurrency wallet artifacts in a file system

Abstract

Systems, methods, and frameworks for detecting cryptocurrency wallet artifacts in a file system of a device are provided. The cryptocurrency wallet artifacts can be automatically detected and can include: (i) cryptocurrency wallet application folders; (ii) images containing cryptocurrency artifacts (e.g., mnemonics phrases and/or transactions information); and/or (iii) web browsers artifacts (e.g., cache data, credentials, cookies, and/or bookmarks). This information can be analyzed and extracted using machine learning (ML), natural language processing (NLP), a convolution neural network (CNN), a recurrent neural network (RNN), and/or a string search algorithm.

What is claimed is: 
     
       1. A system for detecting cryptocurrency wallet artifacts in a file system of a device, the system comprising:
 a processor; 
 a display; and 
 a machine-readable medium in operable communication with the processor and the display and having instructions stored thereon that, when executed by the processor, perform the following steps: 
 a) searching the file system of the device using a machine learning (ML) classifier to detect cryptocurrency related applications installed on the device; 
 b) generating a first list of cryptocurrency related applications installed on the device based on step a); 
 c) analyzing images stored on the file system of the device using a neural network based model to detect cryptocurrency related images stored on the device; 
 d) generating a second list of cryptocurrency related images stored on the device based on step c); 
 e) analyzing a web browser installed on the file system of the device to detect cryptocurrency related browsing activity on the device; 
 f) generating a third list of cryptocurrency related browsing activity on the device based on step e); and 
 g) displaying, on the display via a graphical user interface stored on the machine-readable medium, the first list, the second list, and the third list. 
 
     
     
       2. The system according to  claim 1 , the ML classifier used in step a) comprising a logistic regression based ML classifier. 
     
     
       3. The system according to  claim 1 , the ML classifier used in step a) comprising a support vector machine (SVM). 
     
     
       4. The system according to  claim 1 , step a) comprising the sub-steps of:
 a1) comparing all applications on the file system of the device to a local database stored on the machine-readable medium, where each application on the file system of the device that matches an application listed in the local database is determined to be a cryptocurrency related applications or not based on its status in the local database, and where each application on the file system of the device that does not match any application listed in the local database is searched in step a2); 
 a2) searching an application store for all applications on the file system of the device that did not match any application listed in the local database; and 
 a3) for each application on the file system of the device that did not match any application listed in the local database, using natural language processing (NLP) on a description of the respective application in the application store and categorize the respective application as be a cryptocurrency related applications or not based on the analysis of the description of the respective application in the application store. 
 
     
     
       5. The system according to  claim 4 , the instructions when executed further performing the following step:
 prior to step a3), performing preprocessing on the description of each respective application on the file system of the device that did not match any application listed in the local database, 
 the preprocessing comprising at least one of removal of noises, text tokenization, removal of stop words, and word lemmatization. 
 
     
     
       6. The system according to  claim 1 , the neural network based model used in step c) being a convolutional neural network (CNN) based model. 
     
     
       7. The system according to  claim 1 , the neural network based model used in step c) being a CNN based model combined with fuzzy search. 
     
     
       8. The system according to  claim 1 , step c) comprising the sub-steps of:
 c1) using a neural network to filter the images stored on the file system of the device into three categories, the three categories comprising images with no text, images with printed text, and images with handwritten text; 
 c2) using optical character recognition (OCR) to extract text information from the images with printed text; 
 c3) using handwriting text recognition (HTR) to extract text information from the images with handwritten text; and 
 c4) using a fuzzy search to detect cryptocurrency related images based on the extracted text information from the images with printed text and the extracted text information from the images with handwritten text. 
 
     
     
       9. The system according to  claim 8 , the instructions when executed further performing the following step:
 prior to step c1), filtering out from among the images stored on the file system of the device graphics used for a user interface on the device, where step c1) is performed only on the images stored on the file system of the device that are not filtered out in this step. 
 
     
     
       10. The system according to  claim 1 , the analyzing of the web browser installed on the file system of the device comprising analyzing a web history, bookmarks, user credentials, cookies, and a cache of the web browser. 
     
     
       11. A method for detecting cryptocurrency wallet artifacts in a file system of a device, the method comprising:
 a) searching the file system of the device using a machine learning (ML) classifier to detect cryptocurrency related applications installed on the device; 
 b) generating a first list of cryptocurrency related applications installed on the device based on step a); 
 c) analyzing images stored on the file system of the device using a neural network based model to detect cryptocurrency related images stored on the device; 
 d) generating a second list of cryptocurrency related images stored on the device based on step c); 
 e) analyzing a web browser installed on the file system of the device to detect cryptocurrency related browsing activity on the device; 
 f) generating a third list of cryptocurrency related browsing activity on the device based on step e); and 
 g) displaying, on a display via a graphical user interface, the first list, the second list, and the third list. 
 
     
     
       12. The method according to  claim 11 , the ML classifier used in step a) comprising at least one of a logistic regression based ML classifier and a support vector machine (SVM). 
     
     
       13. The method according to  claim 11 , step a) comprising the sub-steps of:
 a1) comparing all applications on the file system of the device to a local database stored on the machine-readable medium, where each application on the file system of the device that matches an application listed in the local database is determined to be a cryptocurrency related applications or not based on its status in the local database, and where each application on the file system of the device that does not match any application listed in the local database is searched in step a2); 
 a2) searching an application store for all applications on the file system of the device that did not match any application listed in the local database; and 
 a3) for each application on the file system of the device that did not match any application listed in the local database, using natural language processing (NLP) on a description of the respective application in the application store and categorize the respective application as be a cryptocurrency related applications or not based on the analysis of the description of the respective application in the application store. 
 
     
     
       14. The method according to  claim 13 , further comprising:
 prior to step a3), performing preprocessing on the description of each respective application on the file system of the device that did not match any application listed in the local database, 
 the preprocessing comprising at least one of removal of noises, text tokenization, removal of stop words, and word lemmatization. 
 
     
     
       15. The method according to  claim 11 , the neural network based model used in step c) being a convolutional neural network (CNN) based model. 
     
     
       16. The method according to  claim 11 , the neural network based model used in step c) being a CNN based model combined with fuzzy search. 
     
     
       17. The method according to  claim 11 , step c) comprising the sub-steps of:
 c1) using a neural network to filter the images stored on the file system of the device into three categories, the three categories comprising images with no text, images with printed text, and images with handwritten text; 
 c2) using optical character recognition (OCR) to extract text information from the images with printed text; 
 c3) using handwriting text recognition (HTR) to extract text information from the images with handwritten text; and 
 c4) using a fuzzy search to detect cryptocurrency related images based on the extracted text information from the images with printed text and the extracted text information from the images with handwritten text. 
 
     
     
       18. The method according to  claim 17 , further comprising:
 prior to step c1), filtering out from among the images stored on the file system of the device graphics used for a user interface on the device, where step c1) is performed only on the images stored on the file system of the device that are not filtered out in this step. 
 
     
     
       19. The method according to  claim 11 , the analyzing of the web browser installed on the file system of the device comprising analyzing a web history, bookmarks, user credentials, cookies, and a cache of the web browser. 
     
     
       20. A system for detecting cryptocurrency wallet artifacts in a file system of a device, the system comprising:
 a processor; 
 a display; and 
 a machine-readable medium in operable communication with the processor and the display and having instructions stored thereon that, when executed by the processor, perform the following steps: 
 a) searching the file system of the device using a machine learning (ML) classifier to detect cryptocurrency related applications installed on the device; 
 b) generating a first list of cryptocurrency related applications installed on the device based on step a); 
 c) analyzing images stored on the file system of the device using a neural network based model to detect cryptocurrency related images stored on the device; 
 d) generating a second list of cryptocurrency related images stored on the device based on step c); 
 e) analyzing a web browser installed on the file system of the device to detect cryptocurrency related browsing activity on the device; 
 f) generating a third list of cryptocurrency related browsing activity on the device based on step e); and 
 g) displaying, on the display via a graphical user interface stored on the machine-readable medium, the first list, the second list, and the third list, 
 the ML classifier used in step a) comprising at least one of a logistic regression based ML classifier and a support vector machine (SVM), 
 step a) comprising the sub-steps of:
 a1) comparing all applications on the file system of the device to a local database stored on the machine-readable medium, where each application on the file system of the device that matches an application listed in the local database is determined to be a cryptocurrency related applications or not based on its status in the local database, and where each application on the file system of the device that does not match any application listed in the local database is searched in step a2); 
 a2) searching an application store for all applications on the file system of the device that did not match any application listed in the local database; and 
 a3) for each application on the file system of the device that did not match any application listed in the local database, using natural language processing (NLP) on a description of the respective application in the application store and categorize the respective application as be a cryptocurrency related applications or not based on the analysis of the description of the respective application in the application store, 
 
 the neural network based model used in step c) being a convolutional neural network (CNN) based model combined with fuzzy search, 
 step c) comprising the sub-steps of:
 c1) using at least one CNN model to filter the images stored on the file system of the device into three categories, the three categories comprising images with no text, images with printed text, and images with handwritten text; 
 c2) using optical character recognition (OCR) to extract text information from the images with printed text; 
 c3) using handwriting text recognition (HTR) to extract text information from the images with handwritten text; and 
 c4) using a fuzzy search to detect cryptocurrency related images based on the extracted text information from the images with printed text and the extracted text information from the images with handwritten text, 
 
 the instructions when executed further performing the following steps:
 prior to step a3), performing preprocessing on the description of each respective application on the file system of the device that did not match any application listed in the local database; and 
 prior to step c1), filtering out from among the images stored on the file system of the device graphics used for a user interface on the device, where step c1) is performed only on the images stored on the file system of the device that are not filtered out in this step, 
 
 the preprocessing comprising removal of noises, text tokenization, removal of stop words, and word lemmatization, and 
 the analyzing of the web browser installed on the file system of the device comprising analyzing a web history, bookmarks, user credentials, cookies, and a cache of the web browser.